topic Re: date_* fields are NULL for some data. Why? in Reporting

date_* fields are NULL for some data. Why?

the_wolverine — Tue, 05 Apr 2011 02:00:47 GMT

I have a bunch of events that, for some reason, are coming up with NULL values for date_* fields. Why would this happen? The events all contain the correct date/time -- just missing the date_* fields that I wanted to use for reporting.

Re: date_* fields are NULL for some data. Why?

sideview — Tue, 05 Apr 2011 03:36:41 GMT

I think there was a previous question about this but I cant find it.

Somewhat from memory and somewhat from the implications in the link below, the date_* fields are only present when Splunk has extracted the date from the event text itself, and there hasnt been any custom timezone offset or anything applied.

So if you are just using the current time for instance (DATETIME_CONFIG=CURRENT), instead of having Splunk parse it out of the event, or if you are doing some timezone offset in inputs.conf, I think the date_* fields simply dissappear. Which would lead to them showing up in reports as NULL.

http://www.splunk.com/base/Documentation/4.2/User/UseDefaultAndInternalFields

Re: date_* fields are NULL for some data. Why?

gkanapathy — Sun, 10 Apr 2011 01:36:14 GMT

And I think this is considered a bug